Time-measurement secured transactional electronic entity

ABSTRACT

An electronic entity such as a chip card containing time measurement elements includes a capacitative component ( 20 ) having a leak through the dielectric area thereof and being able to be charged when the entity is coupled to an electric power source and a member ( 22 ) for measuring the residual charge of the capacitative component which is implemented in a subsequent measure.

The invention relates to a transactional electronic entity and isdirected in particular to an improvement made to a transactionalelectronic entity so that it is able to produce an indication at leastpartly representative of an elapsed time between two events, theimprovement being noteworthy by virtue of its level of integration andits autonomous operation, i.e. its operation independent of any externaltime measuring system (clock signal generator or the like), which entityis consequently relatively inviolable. For example, the invention may beapplied to any autonomous transactional electronic entity, such as amicrocircuit card, for example, comprising means for coupling it atleast temporarily to an electrical power supply to carry out atransaction. The invention in particular determines the elapsed timebetween two successive transactions, a knowledge of this additional dataitem enabling attempted fraud to be detected and consequently makingtransactions more secure. The term “transaction” refers in a verygeneral sense to any exchange of data between the electronic entity inquestion and any server hosting software capable of controlling saidtransaction, for example a computer, an automatic device equipped with amicrocircuit card reader, or any other equipment capable of exchanginginformation with a microcircuit card of this type or an equivalenttransactional electronic entity. It should be noted that the inventionis of benefit in this context because the means for determining theelapsed time between two transactions may be situated in the autonomoustransactional electronic entity and necessitate no electrical powersupply integrated into said entity.

A secure transaction aims to take into account certain parameters, suchas, for example the identity of the holder of the autonomoustransactional electronic entity (the microcircuit card), a code known tothe cardholder, or a time interval between two events that is consideredto be either normal or abnormal. For example, transactions that do notcontain an indication of the time at which they are effected areconsidered to be much less secure, or even unacceptable in certainsituations. The invention provides a solution to this type of problem.

To be more specific, the invention provides a transactional electronicentity characterized in that it comprises at least one subsystemcomprising a capacitive component having a leak across its dielectricspace, means for coupling said capacitive component to an electricalpower supply to be charged by said electrical power supply, and meansfor measuring the residual charge in said capacitive component, saidresidual charge being at least in part representative of a time elapsedafter said capacitive component is decoupled from said electrical powersupply.

In the case of an autonomous electronic entity, such as a microcircuitcard, for example, the electronic entity as a whole comprises means forconnecting it to an electrical power supply and in this case saidcapacitive component of the subsystem can be charged only if theelectronic entity is connected to the electrical power supply. Thelatter is external to the entity. For example, the electronic entitycould be provided with switching means for disconnecting said capacitivecomponent from the electrical power supply, this disconnection eventinitializing the time measurement. More generally, the time measurement,i.e. the variation of the charge in the capacitive component, starts assoon as the component, after being charged, is electrically isolatedfrom any other circuit and is able to discharge only across its owndielectric space.

However, even if the measured residual charge is physically linked tothe elapsed time between isolating the capacitive component and a givenmeasurement of its residual charge, a measured time between twomeasurements may be determined, the first measurement determining, so tospeak, a reference residual charge (the measured time is considered tobe either normal or abnormal, or could in any event be taken intoaccount to determine if the current use of the electronic entity isnormal or abnormal). The measuring means are used when it is required toknow an elapsed time.

For example, the security of a transaction may be improved if it ispossible to take into account the time that has elapsed between twotransactions involving the same autonomous electronic entity, forexample a microcircuit card such as a bank card, an access control card,etc.

Accordingly, if the time at which a transaction is effected can bestored by a server or a central system and the autonomous entity canevaluate the time that elapses between two transactions, comparing thesetwo times makes the transaction more secure, i.e. detects attemptedfraud taking these parameters into account.

Now, most microcircuit cards cannot verify any time-related informationthat might be supplied to them during a transaction, for the simplereason that they have no internal clock able to operate when they arepowered down. One solution to this problem is for the plastic materialmicrocircuit card to be equipped with a film battery accommodated withinthe thickness of the card. However, this solution is costly, fragile(given its construction), and also vulnerable, since a fraudster mayeasily obtain access to the power supply and consequently to the currentvalues used in the classic differential power analysis (DPA) method ofbreaking a cryptographic process.

The invention enables an entity of the above kind to provide informationon the time between two transactions and to validate that information.The basic idea of the invention is to measure the time between twotransactions using means that do not necessitate an internal electricalpower supply.

To be more precise, the invention relates to an autonomous transactionalelectronic device comprising means for connecting it to an externalelectrical power supply to effect a transaction, characterized in thatit comprises at least one subsystem comprising a capacitive componenthaving a leak across its dielectric space, connected to said externalelectrical power supply to be charged thereby during a transaction, andmeans for measuring the residual charge of said capacitive component,said residual charge being at least partly representative of the elapsedtime since the last transaction.

In a preferred embodiment, the measuring means comprise a field-effecttransistor whose gate is connected to one terminal of said capacitivecomponent, i.e. to one “plate” of a capacitor. This kind of capacitormay be fabricated in MOS technology, its dielectric space consisting ofsilicon oxide. In this case, it is advantageous if the field-effecttransistor is also fabricated in MOS technology. The gate of thefield-effect transistor and the “plate” of the MOS capacitive componentare connected and constitute a kind of floating grid that may beconnected to a component for injecting charge carriers. There may alsobe no electrical connection as such with the external environment. Theconnection of the floating grid may be replaced by an (electricallyisolated) control grid that loads the floating grid, for example by thetunnel effect or by means of “hot carriers”. This grid causes chargecarriers to move toward the floating grid common to the field-effecttransistor and the capacitive component. This technique is well known tomanufacturers of EPROM and EEPROM. The common floating grid remainsisolated during the time period between two connections or couplings toan external power supply, i.e. between two successive transactions. Thetransistor and the capacitive component may then constitute a unitintegrated into the microcircuit or forming part of another microcircuithoused in the same autonomous entity.

During a transaction, when the autonomous electronic entity is stillcoupled to an external electrical power supply, the capacitive componentis charged to a predetermined value, either a known value or a valuethat is measured and stored, and the measuring means are connected toone terminal of the capacitive component. At the end of the transaction,the measuring means, in particular the field-effect transistor, are nolonger supplied with power but the grid connected to the terminal of thecapacitive component is at a voltage corresponding to the charge in thelatter component. Throughout the time period between two transactions,the capacitive component is slowly discharged across its own dielectricspace and the voltage applied to the gate of the field-effect transistortherefore progressively decreases. When the electronic entity is againconnected to an electrical power supply to effect a new transaction, anelectrical voltage is applied between the drain and the source of thefield-effect transistor. Thus a current flowing from the drain to thesource or vice versa is generated and may be collected and analyzed. Thevalue of the electrical current measured depends on the technologicalparameters of the field-effect transistor, the potential differencebetween the drain and the source, and the voltage between the gate andthe substrate. The current therefore depends on charge carriersaccumulated in the floating grid common to the field-effect transistorand to the capacitive component. Consequently, this drain current isalso representative of the time that has elapsed between the twotransactions.

The leakage current of the above type of capacitor depends of course onthe thickness of its dielectric space and on other technologicalparameters such as the lengths and areas of contact of the elements ofthe capacitive component. It is also necessary to take into account thethree-dimensional architecture of the contacts of these components,which may induce phenomena having the particular feature of modifyingthe leakage current parameters (for example modifying the tunnelcapacitance value). The type and quantity of dopants and defects may bemodulated to modify the characteristics of the leakage current.Temperature variations, to be more precise the mean energy input to thecard between two transactions, i.e. during the time period that is to bedetermined, also have an influence. In fact, any parameter intrinsic tothe MOS technology may be used to modulate the time measurement process.Where the heat input is concerned, however, if the dielectric is verythin (less than 5 nanometers thick), the corresponding subsystem ispractically insensitive to temperature but the leak is relatively high,and such that only relatively short time periods may be measured, of theorder of a few minutes or less. This kind of subsystem with a highleakage independent of temperature may nevertheless be used to detectcertain types of fraud. For example, this type of capacitive componentdetects very closely spaced successive resets that are characteristic ofcertain of the DPA attacks referred to above.

To measure longer time periods, it is necessary to use a capacitivecomponent having a thicker dielectric space. In this case, the leak issensitive to temperature variations. To obtain information that issubstantially representative of time only, at least two subsystems asdefined hereinabove are provided, operating “in parallel”. The twotemperature-sensitive capacitive components are defined with differentleaks, other things being equal, i.e. their dielectric spaces (theirsilicon oxide layers) are different thicknesses.

To this end, according to one advantageous feature of the invention, theelectronic entity defined above is characterized in that it comprises atleast two of said subsystems comprising capacitive components havingdifferent leaks across their respective dielectric spaces and in that itfurther comprises means for processing measurements of respectiveresidual charges to extract from said measurements informationsubstantially independent of heat input to said entity during the timeelapsed between two transactions.

For example, the processing means may comprise a table of stored timevalues that is addressed by said respective measurements. In otherwords, each pair of measurements designates a stored time valueindependent of temperature and temperature variations during themeasured period. The electronic entity normally comprises a memoryassociated with the microprocessor and a portion of that memory may beused to store said table.

Alternatively, the processing means may comprise calculation softwareprogrammed to execute a predetermined function for calculating the timeinformation substantially independently of the heat input and as afunction of the two measurements cited above.

The invention will be better understood and other advantages of theinvention will become more clearly apparent in the light of thefollowing description, which is given by way of example only and withreference to the appended drawing, in which:

FIG. 1 is a block diagram of a microcircuit card equipped with theimprovement according to the invention;

FIG. 2 is a theoretical diagram of one of said subsystems; and

FIG. 3 is a block diagram of a variant.

An autonomous transactional electronic entity 11, in this example amicrocircuit card, comprises means 12 for coupling it to an externalelectrical power supply 16. In this example, the entity comprises metalconnection areas adapted to be connected to a card reader unit. Twoconnecting areas 13 a, 13 b are reserved for supplying power to themicrocircuit from an electrical power supply accommodated in the serveror a similar device to which the autonomous electronic entity ismomentarily connected. These connection areas could be replaced by anantenna housed within the thickness of the card and adapted to supplythe microcircuit with the electrical energy necessary for its powersupply whilst assuring the bidirectional transmission of radio frequencysignals for exchanging information. The microcircuit comprises amicroprocessor 14 associated in the conventional way with a memory 15.

In the case of the invention, the electronic entity comprises or isassociated with at least one subsystem 17 for measuring time. Thesubsystem 17, which is represented in more detail in FIG. 2, istherefore housed in the electronic entity. It may form part of themicrocircuit and be produced using the same integration technology asthe microcircuit. In the present example, this subsystem is notconnected to any internal electrical power supply. It can therefore besupplied with power only when the electronic entity is actually coupledto a server or a card reader incorporating an electrical power supply.However, if the electronic entity must be supplied with power at alltimes, the subsystem 17 for measuring time may be supplied with power ornot via switching means for coupling it to or isolating it from theelectrical power supply, these means being an integral part of themicroprocessor 14, for example, or consisting of switches controlled byit.

The subsystem 17 comprises a capacitive component 20 having a leakacross its dielectric space 24 and means 22 for measuring the residualcharge in the capacitive component, said residual charge being at leastpartly representative of the time elapsed since the capacitive componentwas decoupled from the electrical power supply, in the present examplebetween two transactions, i.e. between two operations in which themicrocircuit is effectively coupled to a server, i.e. connected to anexternal electrical power supply. The capacitive component is charged bythe external electrical power supply during a transaction, either bydirect connection, as in the example described here, or by any othermeans for charging the gate. The tunnel effect is one method of chargingthe gate with no direct connection. In the present example, themicroprocessor 14 controls charging of the capacitive component.

In the example, the capacitive component is an MOS technology capacitor.The dielectric space 24 of this capacitor is a layer of silicon oxidedeposited onto the surface of a substrate 26 constituting one of theplates of the capacitor. In the present example this substrate isgrounded, i.e. connected to one of the power supply terminals of theexternal electrical power supply when the latter is connected to thecard. The other plate of the capacitor is a conductive deposit 28 aapplied to the other side of the silicon oxide layer.

Said measuring means essentially comprise a field-effect transistor 30,in the present example fabricated in the MOS technology, like thecapacitor, and whose gate is connected to one terminal of the capacitivecomponent. In the example, the gate is a conductive deposit 28 b of thesame kind as the conductive deposit 28 a that constitutes the plate ofthe capacitive component. These two deposits are either connected toeach other or merged into one deposit. A connection 32 to themicroprocessor 14 applies a voltage to these two deposits for a shorttime interval necessary for charging the capacitive component. Themicroprocessor controls the application of this voltage. More generally,the connection 32 charges the capacitive component 20 at a given time,under the control of the microprocessor, and it is from the time atwhich the microprocessor cuts off this charging connection (or when theelectronic entity as a whole is decoupled from any electrical powersupply) that the discharging of the capacitive component across itsdielectric space begins, this loss of electrical charge beingrepresentative of the elapsed time. The time measurement entailsmomentary conduction of the transistor 30, which presupposes thepresence of an electrical power supply connected between its drain andits source. The MOS field-effect transistor comprises, in addition tothe gate, a gate dielectric space 34 separating the latter from asubstrate 36 in which a drain region 38 and a source region 39 aredefined. The gate dielectric space 34 consists of an insulative layer ofsilicon oxide. The source connection 40 to the source region is groundedand connected to the substrate and the drain connection 41 is connectedto a drain current measuring circuit that includes a resistor 45 to theterminals of which the two inputs of a differential amplifier 46 areconnected. The output voltage of this amplifier is thereforeproportional to the drain current.

The grid 28 b is floating during the time that elapses between twocouplings or connections to an external power supply, i.e. between twosuccessive transactions. In other words, no voltage is applied to thegate during this time. On the other hand, since the gate is connected toa plate of the capacitive component 20, the gate voltage during thistime is equal to the voltage that develops between the terminals of saidcapacitive component and is the result of initial charging thereof underthe control of the microprocessor during the last transaction carriedout.

The thickness of the insulative layer of the transistor is significantlygreater than that of the capacitive component. For example, it isapproximately three times greater than that of the capacitive component.Depending on the intended application, the thickness of the insulativelayer of the capacitive component is from approximately 4 nanometers toapproximately 10 nanometers. When the capacitive component is charged bythe external supply, and after the charging connection has been cut offby the microprocessor 14, the voltage at the terminals of the capacitivecomponent 20 decreases slowly as the latter is progressively dischargedacross its own dielectric space. The discharge of the field-effecttransistor across the dielectric space is negligible given the thicknessof the latter.

For example, if, for a given dielectric space thickness, the gate andthe plate of the capacitive component 6 are charged to 6 volts at timet=0, the time associated with a loss of charge of 1 volt, i.e. to areduction of the voltage to 5 volts, is of the order of 24 seconds for athickness of 8 nanometers.

The following table may be drawn up for different thicknesses:

Time 1 hour 1 day 1 week 1 month Oxide thickness 8.17 nm 8.79 nm 9.17 nm9.43 nm Time accuracy 1.85% 2.09% 2.24% 3.10%

The accuracy depends on the error in reading the drain current(approximately 0.1%). Accordingly, to be able to measure times of theorder of one week, a dielectric space layer of the order of 9 nanometersthick may be provided.

FIG. 2 shows a particular architecture that uses a direct connection tothe floating grid 28 a, 28 b to apply an electrical potential theretoand therefore to cause charges to flow therein. Indirect charging mayalso be used, as mentioned above, thanks to a control grid replacing thedirect connection and employing the technology used to fabricate EPROMand EEPROM cells.

The FIG. 3 variant provides three subsystems 17A, 17B, 17C eachassociated with the microprocessor 14. The subsystems 17A and 17Bcomprise capacitive components having relatively small leaks to measurerelatively long times. However, these capacitive components aresensitive to temperature variables, as indicated above. The thirdsubsystem 17C comprises a capacitive component having a very thindielectric space, less than 5 nanometers thick. It is thereforeinsensitive to temperature variations. The two capacitive components ofthe subsystems 17A, 17B have different leaks across their respectivedielectric spaces. The autonomous electrical entity further comprisesmeans for processing the measurements of the respective residual chargespresent in the capacitive components of the first two subassemblies 17A,17B, these processing means being adapted to extract from saidmeasurements information representative of time and substantiallyindependent of heat input to said entity during the elapsed time betweentwo successive transactions. In the example, these processing means arenone other than the microprocessor 14 and the memory 15. In particular,a space in the latter memory is reserved for storing a double-entrytable T of time values that is addressed by the respective twomeasurements. In other words, a portion of the memory comprises a set oftime values and each value corresponds to a pair of measurementsresulting from reading the drain current of each of the two transistorsof the temperature-sensitive subsystems 17A, 17B.

Accordingly, during a transaction, for example toward the end thereof,the two capacitive components are charged to a predetermined voltage bythe external electrical power supply via the microprocessor 14. When themicrocircuit card is decoupled from the server or card reader, the twocapacitive components remain charged but begin to discharge across theirrespective dielectric spaces, and as time elapses without themicrocircuit card being used the residual charge in each of thecapacitive components decreases, although differently, because of thedifferent leaks determined by their construction.

When the card is again coupled to an electrical power supply, on theoccasion of a new transaction, the residual charges in the twocapacitive components are representative of the same time interval to bedetermined, but different because of temperature variations that mayhave occurred during this time period. When the card is used again, thetwo field-effect transistors of the two subsystems are supplied withpower and the drain current values are read and processed by themicrocircuit. For each pair of drain current values, the microcircuitlooks up the corresponding time value in said table in memory. That timevalue is then compared with the value available in the server and thetransaction is authorized only if these two values coincide or arerelatively close together.

It is not necessary to store the table T. For example, the processingmeans, i.e. essentially the microprocessor 14, may comprise software forcalculating a predetermined function for determining said information asa function of the two measurements and substantially independently ofthe heat input.

As already indicated, the third subsystem 17C comprises an extremelythin dielectric space making it insensitive to temperature variations.This subsystem may be used, under the control of the microprocessor 14,to detect repeated resets that occur often in the event of a DPA attack.

Other variants are feasible. In particular, eliminating the capacitivecomponent 20 as such to simplify the subsystem 17 may be envisaged,since the field-effect transistor 30 itself may be considered as acapacitive component with the grid 28 b and the substrate 36constituting its plates, separated by the dielectric space 34. In thiscase, said capacitive component and said measuring means may beconsidered to be one and the same.

1. An electronic entity for carrying out transactions, comprising: atleast one subsystem comprising a capacitive component having adielectric space with a leak across the dielectric space; means forcoupling said capacitive component to an electrical power supply so thatthe capacitive component is charged by said electrical power supplyduring a first transaction and for decoupling said capacitive componentat the end of the transaction; and means for measuring a residual chargein said capacitive component during a new transaction, said residualcharge being at least in part representative of a time elapsed sincesaid first transaction, wherein fraud is detected by the time elapsedbetween said first transaction and said new transaction.
 2. Electronicentity according to claim 1, characterized in that the electronic entitycomprises switching means for decoupling said capacitive component fromsaid electrical power supply.
 3. Electronic entity according to claim 2,characterized in that said measuring means are used to determine anelapsed time.
 4. Electronic entity according to claim 3, characterizedin that, said capacitive component being charged during a transaction,said measuring means are used during a transaction of this type toprovide information at least partly representative of the time elapsedsince the last transaction.
 5. Electronic entity according to claim 1,characterized in that the electronic entity is autonomous and in thatsaid electrical power supply is external to the electronic entity. 6.Electronic entity according to claim 5, characterized in that theelectronic entity is a microcircuit card.
 7. Electronic entity accordingto claim 1, characterized in that said capacitive component (20) is aMOS technology capacitor whose dielectric space consists of siliconoxide.
 8. Electronic entity according to claim 1, characterized in thatsaid measuring means comprise a field-effect transistor (30) whose gateis connected to a terminal of said capacitive component.
 9. Electronicentity according to claim 8, characterized in that said field-effecttransistor is an MOS transistor, said gate (28 b) floating during thetime that elapses between two connections or couplings to an externalpower supply on the occasion of two successive transactions. 10.Electronic entity according to claim 9, characterized in that saidfield-effect transistor comprises an insulative layer between the gateelectrode and a substrate, said capacitive component comprises aninsulative layer (24) forming the aforementioned dielectric spacedisposed between a plate (28 a) and a substrate (26), and said plate andsaid gate electrode are connected together.
 11. Electronic entityaccording to claim 10, characterized in that the thickness of theinsulative layer (34) of said transistor is substantially greater thanthe insulative layer (24) of said capacitive component.
 12. Electronicentity according to claim 11, characterized in that the thickness ofsaid insulative layer of said transistor is approximately three timesthat of said capacitive component.
 13. Electronic entity according toclaim 11, characterized in that the thickness of the insulative layer ofsaid capacitive component is from 4 nanometers to 10 nanometers. 14.Electronic entity according to claim 8, characterized in that saidfield-effect transistor is an MOS transistor, said gate (28 b) floatingduring the time that elapses between two connections or couplings to anexternal power supply on the occasion of two successive transactions.15. An electronic entity for carrying out transactions, comprising: atleast two subsystems, each subsystem comprising a capacitive componenthaving a dielectric space with a leak across the dielectric space, saidleaks of said at least two subsystems being different; means forcoupling said capacitive components to an electrical power supply sothat said capacitive components are charged by said electrical powersupply during a first transaction and for decoupling said capacitivecomponents at the end of said first transaction; means for measuring arespective residual charge in each of said capacitive components duringa new transaction, each of said respective residual charges in saidcapacitive components being at least in part representative of a timeelapsed since said first transaction; and means for processingmeasurements of said respective residual charges to extract from saidmeasurements information substantially independent of heat input to saidelectronic entity during the time elapsed between the two transactions.16. Electronic entity according to claim 15, characterized in that saidprocessing means comprise a table of stored time values (T) addressed bysaid respective measurements.
 17. Electronic entity according to claim15, characterized in that the electronic entity comprises a memory spacedefining said table.
 18. Electronic entity according to claim 15,characterized in that said processing means comprise software forcalculating a predetermined function for determining said information asa function of said measurements and substantially independently of theheat input.
 19. An electronic entity for carrying out transactions,comprising: an electrical power supply; a capacitive component having adielectric space with a leak across the dielectric space; a connector,said connector couples said capacitive component to the electrical powersupply so that the capacitive component is charged by said electricalpower supply during a first transaction and for decoupling saidcapacitive component at the end of the transaction; and a field-effecttransistor, said field-effect transistor measures a residual charge insaid capacitive component during a new transaction, said residual chargebeing at least in part representative of a time elapsed since said firsttransaction, wherein fraud is detected by the time elapsed between saidfirst transaction and said new transaction.